diff --git a/{{ cookiecutter.package_name }}/.github/workflows/ci.yml b/{{ cookiecutter.package_name }}/.github/workflows/ci.yml
index 8b1e093..0c896ab 100644
--- a/{{ cookiecutter.package_name }}/.github/workflows/ci.yml	
+++ b/{{ cookiecutter.package_name }}/.github/workflows/ci.yml	
@@ -32,14 +32,14 @@ permissions: {}
 jobs:
   core:
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8c8bb6c6c962542921f993d47d26df38dccd50b1  # v3.0.2
+    permissions:
+      id-token: write
     with:
       submodules: false
-      coverage: codecov
+      coverage: codecov-oidc
       toxdeps: tox-pypi-filter
       envs: |
         - linux: py313
-    secrets:
-      CODECOV_TOKEN: {{ '${{ secrets.CODECOV_TOKEN }}' }}
 
   sdist_verify:
     runs-on: ubuntu-latest
@@ -58,9 +58,11 @@ jobs:
   test:
     needs: [core, sdist_verify]
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8c8bb6c6c962542921f993d47d26df38dccd50b1  # v3.0.2
+    permissions:
+      id-token: write
     with:
       submodules: false
-      coverage: codecov
+      coverage: codecov-oidc
       toxdeps: tox-pypi-filter
       posargs: -n auto
       envs: |
@@ -69,8 +71,6 @@ jobs:
         - macos: py312
         - linux: py312-oldestdeps
         - linux: py314-devdeps
-    secrets:
-      CODECOV_TOKEN: {{ '${{ secrets.CODECOV_TOKEN }}' }}
 
   docs:
     needs: [core]
@@ -91,9 +91,12 @@ jobs:
   {{ env }}:
     needs: [core]
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8c8bb6c6c962542921f993d47d26df38dccd50b1  # v3.0.2
+    permissions:
+      id-token: write
     with:
       submodules: false
       toxdeps: tox-pypi-filter
+      coverage: codecov-oidc
       envs: |
   {% endfor -%}
   {%- endif %}